DATABASE_URL=postgresql://curio:curio@localhost:5433/curio

# Auth.js v5
AUTH_SECRET=                      # openssl rand -hex 32
AUTH_URL=http://localhost:3000
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=
AUTH_GITHUB_ID=
AUTH_GITHUB_SECRET=

# Authentik / generic OIDC (optional — any OIDC-compliant IdP: Keycloak, Dex, etc.)
# Leave AUTH_OIDC_ISSUER blank to disable the SSO button entirely.
AUTH_OIDC_ISSUER=                   # e.g. https://authentik.example.com/application/o/curio/
AUTH_OIDC_CLIENT_ID=
AUTH_OIDC_CLIENT_SECRET=
AUTH_OIDC_DISPLAY_NAME=SSO          # Label shown on the login button

# Email verification (optional — nodemailer)
SMTP_HOST=smtp.eu.mailgun.org
SMTP_PORT=587
SMTP_USER=curio@arnaudne.fr
SMTP_PASS=1e314233c1b2c72b89dee03622bde622-0b3150f2-43f373c4
EMAIL_FROM=curio@arnaudne.fr

# Langfuse — LLM call observability (optional; logs to console when absent)
LANGFUSE_SECRET_KEY=
LANGFUSE_PUBLIC_KEY=
LANGFUSE_HOST=https://cloud.langfuse.com

# Per-session output token cap (~50k ≈ 3–4 full lessons of grading + probes)
SESSION_TOKEN_BUDGET=50000
REDIS_URL=redis://localhost:6379

# Upstash Redis (REST API) — cold-start rate limiter; optional, degrades gracefully
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# Generator model — strong, creative (defaults to Anthropic Claude)
LLM_GENERATOR_PROVIDER=anthropic
LLM_GENERATOR_MODEL=claude-sonnet-4-6
ANTHROPIC_API_KEY=

# Grader model — different provider for decorrelation (defaults to OpenAI)
LLM_GRADER_PROVIDER=openai
LLM_GRADER_MODEL=gpt-4o-mini
OPENAI_API_KEY=

# Cheap grader — fast/low-cost model for rubric-matched majority cases (§10.2 cascade)
# Falls back to LLM_GRADER_* when not set (no performance benefit, but safe default)
LLM_CHEAP_GRADER_PROVIDER=openai
LLM_CHEAP_GRADER_MODEL=gpt-4o-mini

# Safety mode: open | controlled (default) | enterprise-safe (§14)
CONTENT_SAFETY_MODE=controlled

# Embedding model — used for RAG retrieval (defaults to OpenAI)
LLM_EMBED_PROVIDER=openai
LLM_EMBED_MODEL=text-embedding-3-small

# ── Google Gemini (provider=google) ──────────────────────────────────────────
# Models: gemini-2.0-flash, gemini-2.5-pro, etc. Supports embeddings.
GOOGLE_GENERATIVE_AI_API_KEY=

# ── Mistral (provider=mistral) ────────────────────────────────────────────────
# Models: mistral-large-latest, mistral-small-latest. Supports embeddings.
MISTRAL_API_KEY=

# ── Cohere (provider=cohere) ──────────────────────────────────────────────────
# Models: command-r-plus, command-r. Supports embeddings (embed-english-v3.0).
COHERE_API_KEY=

# ── Groq (provider=groq) ──────────────────────────────────────────────────────
# Models: llama-3.3-70b-versatile, mixtral-8x7b-32768. No embeddings.
GROQ_API_KEY=

# ── xAI / Grok (provider=xai) ────────────────────────────────────────────────
# Models: grok-3, grok-3-mini. No embeddings.
XAI_API_KEY=

# ── AWS Bedrock (provider=bedrock) ────────────────────────────────────────────
# Models: anthropic.claude-sonnet-4-6-v1, amazon.titan-embed-text-v2:0, etc.
# Uses AWS SDK credential chain (env vars, ~/.aws/credentials, IAM role).
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# ── Azure OpenAI (provider=azure) ─────────────────────────────────────────────
# model = deployment name (not model name). Supports embeddings.
AZURE_OPENAI_RESOURCE_NAME=
AZURE_API_KEY=

# ── OpenRouter (provider=openrouter) ─────────────────────────────────────────
# Routes to any model. No embeddings — keep LLM_EMBED_PROVIDER=openai.
# Model IDs: "anthropic/claude-sonnet-4-6", "google/gemini-2.0-flash", etc.
OPENROUTER_API_KEY=

# ── Ollama (provider=ollama) ──────────────────────────────────────────────────
# Local. No API key. Supports embeddings (nomic-embed-text).
OLLAMA_BASE_URL=http://localhost:11434/api

# ── Fully local example (no API keys) ────────────────────────────────────────
# LLM_GENERATOR_PROVIDER=ollama
# LLM_GENERATOR_MODEL=llama3.2
# LLM_GRADER_PROVIDER=ollama
# LLM_GRADER_MODEL=llama3.2
# LLM_EMBED_PROVIDER=ollama
# LLM_EMBED_MODEL=nomic-embed-text